diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml
new file mode 100644
index 0000000..1fd54b7
--- /dev/null
+++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml
@@ -0,0 +1,22 @@
+{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: https
+      port: 443
+      targetPort: k8s-registrar
+      protocol: TCP
+  selector:
+    {{- include "spire-server.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml
index 3904a9d..c9b81f7 100644
--- a/charts/spire/charts/spire-server/templates/statefulset.yaml
+++ b/charts/spire/charts/spire-server/templates/statefulset.yaml
@@ -85,6 +85,10 @@ spec:
           args:
             - -config
             - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
+          ports:
+            - name: k8s-registrar
+              containerPort: 9443
+              protocol: TCP
           resources:
             {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }}
           volumeMounts: